Trojan.Siggen21.26234

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\Remote Access Service] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Remote Access Service] 'ImagePath' = '"%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"'

Создает следующие сервисы

'Remote Access Service' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"
'Remote Access Service' %ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\jwrapper-remote access\logs\wrapper-2023-09-05-19-21-02-303.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\detectedproxies
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\proxycredentials
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\remoteaccess-jar-with-dependencies.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\fontconfig.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\translations\de.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\translations\en.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\translations\es.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\translations\fr.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\translations\it.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\translations\nl.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-remote_work_setup
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride.afos_interim
%ALLUSERSPROFILE%\jwrapper-remote access\logs\genericupdater-2023-09-05-19-21-57-254-pid0.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-remote_access_configure
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-remote_access_restart
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-remote_access_service
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-remote_access_launcher
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-permissions
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-remote_access_session
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-stop_remote_access_service
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-manage_remote_access_service
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-autotest
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-headlesstest
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-remote_access_monitoring
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\translations\pt.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\translations\da.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\charsets.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\translations\sv.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\access-bridge-64.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\jsse.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\jsse.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\jaccess.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\jaccess.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\sunpkcs11.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\sunpkcs11.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\openjsse.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\openjsse.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\legacy8ujsse.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\legacy8ujsse.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\cldrdata.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-windows64jre-00084000053-complete\bin\remote access.exe
%TEMP%\hsperfdata_user\3868
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-jwrapper-00097526671-complete\unrestricted\jwlaunchproperties-1749801645-23
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\sunmscapi.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\sunmscapi.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\rt.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\rt.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\third_party_readme
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\welcome.html
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\release
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\disclaimer
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\windowslauncher.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\cldrdata.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\access-bridge-64.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\charsets.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-jwrapperpostinstallapp
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-jwrapper_service_management_app
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\remote access\uninstall remote access.lnk
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\chosenlanguage
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\unrestricted\jwlastrun
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-jwrapper-00097526671-complete\unrestricted\jwlastrun
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-windows64jre-00084000053-complete\unrestricted\jwlastrun
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\unrestricted\jwlaunchproperties-1693966942455-3
%TEMP%\hsperfdata_user\2936
%ALLUSERSPROFILE%\jwrapper-remote access\logs\remote access-remote access configure-2023-09-05-19-22-24-190-pid2936.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\shcad.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\simpleservice.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\cadasuser.exe
%ALLUSERSPROFILE%\jwrapper-remote access\logs\remote access-jwrapperpostinstallapp-2023-09-05-19-22-21-282-pid2488.log
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\remote access\remote access configure.lnk
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\winpty-agent64.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\utils_wnative_intel-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\utils_wnative_winpty_intel-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\utils_wnative_shpty_intel-64.dll
%TEMP%\sgconfig5723880391103303799temp
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceconfig.xml
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\remote access service.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\stopsimplegatewayservice.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\simplegateway.service
%ALLUSERSPROFILE%\jwrapper-remote access\logs\wrapper-2023-09-05-19-22-31-557.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-jwrapper-00097526671-complete\unrestricted\jwlaunchproperties-1749836990-23
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\simplehelper64.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\utils_wnative_dxgi_intel-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-jwrapperjrecompatibilityapp
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-jwrapperpostuninstallapp
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-windows64jre-00084000053-complete\bin\remote accesslauncher.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwrapper-remote access-splash.png
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwrapper-remote access-icns.icns
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwrapper-remote access-uninstallerico.icopng
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwrapper_license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappnote-jwrapperjrecompatibilityapp
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwbuildversion
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwrapperlaunch
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\elev_mac
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\remote accesswinlauncher.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\session_win.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\unrestricted\jwlaunchproperties-1693966939545-2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwappspec-update
%TEMP%\hsperfdata_user\2488
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\elev_win.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\unrestricted\jwlaunchproperties-1693966936932-0
%TEMP%\hsperfdata_user\2844
%ALLUSERSPROFILE%\jwrapper-remote access\logs\remote access-jwrapperjrecompatibilityapp-2023-09-05-19-22-18-425-pid2844.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jre-lastsuccessfuloptions-jwrapper-windows64jre-00084000053-complete
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwrapperusejre
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\unrestricted\jwrapperusejre
%ALLUSERSPROFILE%\jwrapper-remote access\jwupdatearinstruction.ar-inst-incomplete
%ALLUSERSPROFILE%\jwrapper-remote access\remote accesswinlauncher.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\remote_access_configureico.ico
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jwrapper-remote access-uninstallerico.ico
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\jwutils_win64.dll
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\83aa4cc77f591dfc2374580bbd95f6ba_d4602615-9d50-4880-be41-678935e93eaa
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-windows64jre-00084000053-complete\bin\remote accessecompatibility.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\crs-agent.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\crs-agent.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\cmm\srgb.pf
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\splashscreen.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\mlib_image.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\fontmanager.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\management.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jawt.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jawtaccessbridge-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\awt.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\hprof.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\java.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\javaw.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\dt_socket.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\lcms.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\dt_shmem.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jsdt.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\javaaccessbridge-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\server\jvm.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\server\xusage.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\npt.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jsoundds.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\net.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\pack200.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\msvcr100.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\freetype.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jpeg.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\nio.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\j2pkcs11.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jdwp.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\libjwutils_linux32.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwbuildversion
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwrapperlib\jwstandalonelaunch.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwrapperlib\jwstandalone.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwrapper-remote access-splash.png
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwrapper-remote access-icns.icns
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\session_win.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwutils_win32.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwutils_win64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\libjwutils_linux64.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\elev_mac
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\libjwutils_linux64arm.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\sunec.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jli.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\nativesplash.png
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\libjwutils_macos.jnilib
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\simpleservice.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwauthorpublickey
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwrapperlaunch
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\jwrapper-jwrapper-version.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-jwrapper-00097526671-complete\jwrapper-windows64jre-version.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jjs.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\zip.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\java.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jaas_nt.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\windowsaccessbridge-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\elev_win.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966862-5-app\libjwutils_linux32arm.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\sunmscapi.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\w2k_lsa_auth.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\images\cursors\win32_linkdrop32x32.gif
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\images\cursors\cursors.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\images\cursors\win32_movedrop32x32.gif
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\policy\limited\us_export_policy.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\policy\limited\local_policy.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\policy\unlimited\us_export_policy.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\policy\unlimited\local_policy.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\cacerts
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\java.policy
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\java.security
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\openjsse.security
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\images\cursors\win32_linknodrop32x32.gif
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\images\cursors\win32_copynodrop32x32.gif
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\images\cursors\win32_copydrop32x32.gif
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\blacklisted.certs
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\currency.data
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\sound.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\logging.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\fontconfig.properties.src
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\psfontj2d.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\tzmappings
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\cmm\linear_rgb.pf
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\cmm\gray.pf
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\cmm\pycc.pf
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\cmm\ciexyz.pf
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\security\legacy8ujsse.security
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\hijrah-config-umalqura.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\calendars.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\images\cursors\invalid32x32.gif
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\images\cursors\win32_movenodrop32x32.gif
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\jsound.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\j2pcsc.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\instrument.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\java-rmi.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\classpath_exception_note
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\readme.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\classlist
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\psfont.properties.ja
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\flavormap.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\jce.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\management-agent.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\meta-index
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\fontconfig.bfc
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\verify.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\content-types.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\resources.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\management\jmxremote.password.template
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\management\management.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\management\snmp.acl.template
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\management\jmxremote.access
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\amd64\jvm.cfg
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\meta-index
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\sunjce_provider.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\sunec.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\tzdb.dat
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\accessibility.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\net.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\jvm.hprof.txt
%WINDIR%\temp\hsperfdata_ggicdomruqck$\2244
%ALLUSERSPROFILE%\jwrapper-remote access\logs\genericupdater-2023-09-05-19-22-33-878-pid0.log

Удаляет следующие файлы

%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\crs-agent.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\unrestricted\jwlaunchproperties-1693966942455-3
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access-00097526687-complete\unrestricted\jwlaunchproperties-1693966939545-2
%ALLUSERSPROFILE%\jwrapper-remote access\jwupdatearinstruction
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\unrestricted\jwlaunchproperties-1693966936932-0
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\remoteaccess-jar-with-dependencies.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride.afos_complete
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-jwrapper-00097526671-complete\unrestricted\jwlaunchproperties-1749801645-23
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\rt.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\sunmscapi.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\access-bridge-64.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\cldrdata.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\legacy8ujsse.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\openjsse.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\sunpkcs11.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\ext\jaccess.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\jsse.jar.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\lib\charsets.jar.p2
%TEMP%\sgconfig5723880391103303799temp
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-jwrapper-00097526671-complete\unrestricted\jwlaunchproperties-1749836990-23

Перемещает следующие файлы

%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride.afos_interim в %ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride.afos_complete
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\remoteaccess-jar-with-dependencies.jar в %ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\remoteaccess-jar-with-dependencies.p2
%ALLUSERSPROFILE%\jwrapper-remote access\jwupdatearinstruction.ar-inst-incomplete в %ALLUSERSPROFILE%\jwrapper-remote access\jwupdatearinstruction

Подменяет следующие файлы

%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966918706-5\remoteaccess-jar-with-dependencies.jar

Сетевая активность

Подключается к

'14#.#02.188.209':80

TCP

Запросы HTTP GET

http://14#.#02.188.209/access/JWrapper-Windows64JRE-version.txt?ti#############
http://14#.#02.188.209/access/JWrapper-Windows64JRE-00084000053-archive.p2.l2
http://14#.#02.188.209/access/JWrapper-Remote%20Access-version.txt
http://14#.#02.188.209/access/JWrapper-JWrapper-version.txt
http://14#.#02.188.209/access/JWrapper-Remote%20Access-00097526687-archive.p2.l2
http://14#.#02.188.209/access/JWrapper-Remote%20Access_os_jwwin64-version.txt
http://14#.#02.188.209/access/JWrapper-Remote%20Access_os_jwwin64-00097526687-archive.p2.l2
http://14#.#02.188.209/access/JWrapper-Remote%20Access_winutils64-version.txt
http://14#.#02.188.209/access/JWrapper-Remote%20Access_winutils64-00097526687-archive.p2.l2

Другое

Создает и запускает на исполнение

'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\crs-agent.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\crs-agent.jar"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\remote access service.exe'
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe'
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe' -install "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe' -uninstall "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-windows64jre-00084000053-complete\bin\remote access.exe' -cp "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapper-Remote Access-00097526687-complete\remoteaccess-jar-with-dependencies.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30...
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-windows64jre-00084000053-complete\bin\remote accesslauncher.exe' -cp "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapper-Remote Access-00097526687-complete\remoteaccess-jar-with-dependencies.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30...
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-windows64jre-00084000053-complete\bin\remote accessecompatibility.exe' -cp "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966918706-5\remoteaccess-jar-with-dependencies.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPause...
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\windowslauncher.exe' "-Xshare:dump"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\rt.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\rt.jar"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\access-bridge-64.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\access-b...
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\cldrdata.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\cldrdata.jar"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\legacy8ujsse.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\legacy8ujsse...
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\openjsse.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\openjsse.jar"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\sunpkcs11.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\sunpkcs11.jar"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\jaccess.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\jaccess.jar"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\jsse.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\jsse.jar"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\charsets.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\charsets.jar"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1693966877-6-app\bin\unpack200.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\sunmscapi.jar.p2" "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapperTemp-1693966877-6-app\lib\ext\sunmscapi.jar"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-windows64jre-00084000053-complete\bin\remote access.exe' "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UI...
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\remote access service.exe' ' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\restricted" /t /c /grant *S-1-5-32-545:(OI)(CI)RX

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней